Monthly
Denial of service in pypdf before 6.21.2: a crafted PDF whose standard cross-reference table declares a larger entry count than the file can physically contain drives the parser into excessive iteration and long runtimes simply when the document is opened. The CVSS vector shows no privileges required (PR:N) but a victim interaction of opening or processing the file (UI:P), so the realistic exposure is services that ingest untrusted PDFs such as upload portals, mail/attachment scanners and OCR or document pipelines. Impact is availability-only (no confidentiality or integrity effect), the vendor fix is version 6.21.2, and no public exploit code was identified at the time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
CPU exhaustion in Bouncy Castle for Java's MLS (Messaging Layer Security) implementation allows a network attacker to trigger unbounded HKDF key-derivation iterations by supplying a crafted 32-bit generation counter in an MLS message. The hash-ratchet in GroupKeySet.get(int generation) advances one HKDF step per skipped generation without any upper bound, so a maximally crafted counter forces up to ~4.29 billion derivation steps on the receiving process. Scored CVSS 4.0 at 8.7 with High availability impact and no authentication prerequisites per vendor scoring; no public exploit code or KEV listing has been identified at time of analysis.
Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.
Denial of service in Apache CouchDB 3.5.2 and earlier: the replicator lacks a circuit-breaker on HTTP redirects, so a replication endpoint that returns an endless redirect chain keeps the replicator chasing it indefinitely and degrades availability of the replication subsystem. The attacker must be an authenticated owner of a replication source or target (PR:L) and must control that endpoint's HTTP responses, so this is not reachable by an unauthenticated outsider and affects only availability, not confidentiality or integrity. Scoring is low (independent assessment: CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L; vendor CVSS 4.0 base 0.6), and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a low-priority issue despite being network-reachable.
Denial of service in the quirc QR-code decoding library (versions through 1.2) allows an attacker who supplies a crafted QR image to hang the decoder in quirc_end(), pinning a CPU core for an effectively unbounded time. The excessive-iteration flaw lives in find_alignment_pattern() in lib/identify.c: a slide of three finder patterns can produce a near-degenerate perspective transform whose near-zero denominator inflates size_estimate, driving the alignment-pattern spiral through billions of region_code() iterations on a tiny image. Impact is availability-only (CVSS 4.0 VC:N/VI:N/VA:H; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): no authentication is required, but exploitation needs the host application to actually decode attacker-controlled image data (UI:P / UI:R passive interaction), so exposure is limited to services or apps that automatically run quirc over untrusted uploads; no public exploit was identified at time of analysis, though a public technical writeup of the loop condition exists and an upstream fix has been published as PR #159.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Resource exhaustion in pypdf before 6.15.0 enables denial of service via crafted PDF files containing CID font width entries with maliciously large range values. Any application that processes untrusted PDFs using pypdf's text extraction or font parsing routines is affected, as the library iterates over attacker-controlled CID width ranges without bounds enforcement, consuming excessive CPU and memory. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service via algorithmic complexity in pypdf before 6.12.0 allows an attacker who can supply a crafted PDF file to cause excessive processing time during cross-reference stream parsing. The vulnerability is triggered by crafting a PDF with /W [0 0 0] field values in a cross-reference stream combined with a large /Size value, which causes the library to perform unbounded iteration over zero-byte entries. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, any application that processes untrusted PDF input using pypdf is exposed.
Denial of service via algorithmic complexity in pypdf versions prior to 6.10.2 allows local attackers to cause long runtimes by crafting a PDF with an excessively large trailer /Size value when loaded in incremental mode. The vulnerability requires user interaction to load the malicious PDF and results in availability degradation rather than data compromise. Patch version 6.10.2 is available from the vendor.
Denial of service in pypdf before 6.21.2: a crafted PDF whose standard cross-reference table declares a larger entry count than the file can physically contain drives the parser into excessive iteration and long runtimes simply when the document is opened. The CVSS vector shows no privileges required (PR:N) but a victim interaction of opening or processing the file (UI:P), so the realistic exposure is services that ingest untrusted PDFs such as upload portals, mail/attachment scanners and OCR or document pipelines. Impact is availability-only (no confidentiality or integrity effect), the vendor fix is version 6.21.2, and no public exploit code was identified at the time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
CPU exhaustion in Bouncy Castle for Java's MLS (Messaging Layer Security) implementation allows a network attacker to trigger unbounded HKDF key-derivation iterations by supplying a crafted 32-bit generation counter in an MLS message. The hash-ratchet in GroupKeySet.get(int generation) advances one HKDF step per skipped generation without any upper bound, so a maximally crafted counter forces up to ~4.29 billion derivation steps on the receiving process. Scored CVSS 4.0 at 8.7 with High availability impact and no authentication prerequisites per vendor scoring; no public exploit code or KEV listing has been identified at time of analysis.
Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.
Denial of service in Apache CouchDB 3.5.2 and earlier: the replicator lacks a circuit-breaker on HTTP redirects, so a replication endpoint that returns an endless redirect chain keeps the replicator chasing it indefinitely and degrades availability of the replication subsystem. The attacker must be an authenticated owner of a replication source or target (PR:L) and must control that endpoint's HTTP responses, so this is not reachable by an unauthenticated outsider and affects only availability, not confidentiality or integrity. Scoring is low (independent assessment: CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L; vendor CVSS 4.0 base 0.6), and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a low-priority issue despite being network-reachable.
Denial of service in the quirc QR-code decoding library (versions through 1.2) allows an attacker who supplies a crafted QR image to hang the decoder in quirc_end(), pinning a CPU core for an effectively unbounded time. The excessive-iteration flaw lives in find_alignment_pattern() in lib/identify.c: a slide of three finder patterns can produce a near-degenerate perspective transform whose near-zero denominator inflates size_estimate, driving the alignment-pattern spiral through billions of region_code() iterations on a tiny image. Impact is availability-only (CVSS 4.0 VC:N/VI:N/VA:H; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): no authentication is required, but exploitation needs the host application to actually decode attacker-controlled image data (UI:P / UI:R passive interaction), so exposure is limited to services or apps that automatically run quirc over untrusted uploads; no public exploit was identified at time of analysis, though a public technical writeup of the loop condition exists and an upstream fix has been published as PR #159.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Resource exhaustion in pypdf before 6.15.0 enables denial of service via crafted PDF files containing CID font width entries with maliciously large range values. Any application that processes untrusted PDFs using pypdf's text extraction or font parsing routines is affected, as the library iterates over attacker-controlled CID width ranges without bounds enforcement, consuming excessive CPU and memory. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service via algorithmic complexity in pypdf before 6.12.0 allows an attacker who can supply a crafted PDF file to cause excessive processing time during cross-reference stream parsing. The vulnerability is triggered by crafting a PDF with /W [0 0 0] field values in a cross-reference stream combined with a large /Size value, which causes the library to perform unbounded iteration over zero-byte entries. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, any application that processes untrusted PDF input using pypdf is exposed.
Denial of service via algorithmic complexity in pypdf versions prior to 6.10.2 allows local attackers to cause long runtimes by crafting a PDF with an excessively large trailer /Size value when loaded in incremental mode. The vulnerability requires user interaction to load the malicious PDF and results in availability degradation rather than data compromise. Patch version 6.10.2 is available from the vendor.